Methods and systems for detection and classification of multimedia content in secured transactions using pattern matching

ABSTRACT

An apparatus is provided for classifying content in one or more transactions. The apparatus includes a transaction boundary detector to detect boundaries of the one or more transactions associated with a first server or a first destination, wherein the one or more transactions include one or more requests from a client or a source and one or more corresponding responses from the first server or the first destination. A multimedia session generator generates a multimedia session object based on the detected boundaries of the one or more transactions. A multimedia classifier classifies the content associated with a first multimedia session. A traffic processing and policy enforcement unit applies traffic management to the first multimedia session based upon the classification.

RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.14/629,917 filed Feb. 24, 2015, which is hereby incorporated herein inits entirety by reference.

BACKGROUND

The recent few years has witnessed an explosive growth of data trafficin networks, particularly in cellular wireless networks. This growth hasbeen fueled by a number of new developments that includes faster,smarter, and more intuitive mobile devices such as the popular iPhone®series and the iPad® series, as well as faster wireless and cellularnetwork technologies that deliver throughputs on par or better thanfixed line broadband technologies.

For many people today, a primary mode of access to the Internet is viamobile devices using cellular wireless networks. Users have come toexpect the same quality of experience as in fixed line broadbandnetworks. To meet this insatiable demand, wireless network operators aretaking a number of steps such as installing additional cell towers incongested areas, upgrading the backhaul network infrastructure thatconnects the base stations with the packet core, and deploying newerradio access technologies such as Dual-Cell High Speed Downlink PacketAccess (DC-HSDPA) and Long Term Evolution (LTE). While these approacheshelp with meeting the demand for quality of experience, the slow pace atwhich major network upgrades can be made is not keeping up with the rateat with data traffic is growing. Furthermore, the cost of such networkupgrades is not commensurate with the revenue per subscriber that thewireless operator is able to get, i.e., the cost being much higher thanany increase in revenue the wireless operator can expect. Faced withthese challenges, cellular wireless network operators across the globeare introducing various traffic management techniques to control thegrowth of data traffic and increase their revenues at the same time.

Traffic Management is a broad concept and includes techniques such asthrottling of low priority traffic, blocking or time shifting certaintypes of traffic, and traffic optimization. Optimization of web andvideo traffic is a key component in the array of traffic managementtechniques used by wireless operators. Web traffic refers to traditionalweb site browsing, and video traffic refers to watching videos over theInternet—between the two, web and video traffic account for more than80% of the data traffic in typical cellular wireless networks.

SUMMARY

An apparatus for classifying content in one or more transactionsincludes a transaction boundary detector configured to detect boundariesof the one or more transactions associated with a first server or afirst destination, wherein the one or more transactions include one ormore requests from a client or a source and one or more correspondingresponses from the first server or the first destination. A multimediasession generator generates a multimedia session object based on thedetected boundaries of the one or more transactions. A multimediaclassifier classifies the content associated with a first multimediasession. A traffic processing and policy enforcement unit appliestraffic management to the first multimedia session based upon theclassification.

The applied traffic management includes at least one of blocking, ratelimiting, and lossless and lossy data compression.

A multimedia detector detects the presence of multimedia content in theone or more transactions, prior to the detection of the boundaries bythe transaction boundary detector.

The transaction boundary detector is configured to detect boundariesbased on at least one of a closed TCP connection or an idle time betweenconsecutive transactions.

Detecting the boundaries by the transaction boundary detector comprisesacquiring data that is request data or response data. The request datais included in the one or more requests from the client or the sourceand the response data is included in the one or more correspondingresponses from the first server or the first destination. Thetransaction boundary detector determines whether the acquired data isrequest data or response data. If the acquired data is request data, adetermination is made on whether an active request object is open. Ifthe acquired data is response data, a determination is made on whetheran active response object is open.

A transaction identifier is configured to, prior to the multimediasession generator generating the multimedia session object, identifyingspecific transactions in the one or more transactions based on the sizesof the specific transactions.

The multimedia session generator generates the multimedia session objectcomprises the multimedia session generator being configured to identify,based on the detected boundaries of the one or more transactions,transactions that are associated with the same client IP addresses andthe same server IP address, or the same source IP addresses and the samedestination IP addresses. The multimedia session object is generatedbased on the identification.

The multimedia classifier classifying the content comprises themultimedia classifier determining the relation of the number oftransactions associated with the multimedia session object with respectto a first threshold number of transactions. If the number oftransactions associated with the multimedia session object satisfies thefirst threshold number of transactions, then determine the relation ofthe number of a first type transactions with respect to a secondthreshold number of transactions. The first type of transactions hastransaction sizes corresponding to an audio transaction size range ofthe HLS protocols.

Another aspect is directed to a method for classifying content in one ormore transactions, comprising detecting boundaries of the one or moretransactions associated with a first server or a first destination,wherein the one or more transactions include one or more requests from aclient or a source and one or more corresponding responses from thefirst server or the first destination. The method further includesgenerating a multimedia session object based on the detected boundariesof the one or more transactions, classifying content associated with afirst multimedia session, and applying traffic management to the firstmultimedia session based upon the classification.

Yet another aspect is directed to a non-transitory computer readablestorage medium storing instruction that are executable by one or moreprocessors of an apparatus to cause the apparatus to perform a methodfor classifying content in one or more transactions as described above.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an exemplary network system, consistentwith embodiments of the present disclosure.

FIG. 2 is a block diagram illustrating an exemplary embodiment of anadaptive traffic manager, consistent with embodiments of the presentdisclosure.

FIG. 3 is a flowchart representing an exemplary method for detecting andclassifying content in unsecured or secured transactions, consistentwith embodiments of the present disclosure.

FIG. 4A is a flowchart representing an exemplary method for detectingtransaction boundaries, consistent with embodiments of the presentdisclosure.

FIG. 48 is a block diagram illustrating exemplary client requestobjects, consistent with embodiments of the present disclosure.

FIG. 40 is a block diagram illustrating exemplary server responseobjects, consistent with embodiments of the present disclosure.

FIG. 5A is a flowchart representing an exemplary method for generatingand retrieving a multimedia session object, consistent with embodimentsof the present disclosure.

FIG. 5B is a block diagram illustrating an exemplary multimedia sessionobject, consistent with embodiments of the present disclosure.

FIG. 5C is an exemplary diagram illustrating an exemplary structure of amultimedia session object look-up table.

FIG. 6 is a flowchart representing an exemplary method for classifyingcontent, consistent with embodiments of the present disclosure.

FIG. 7 is a flowchart representing an exemplary method for classifyingcontent in a plurality of transactions associated with two or moreservers, consistent with embodiments of the present disclosure.

DETAILED DESCRIPTION

Reference will now be made in detail to the exemplary embodimentsconsistent with the embodiments disclosed herein, the examples of whichare illustrated in the accompanying drawings. Wherever possible, thesame reference numbers will be used throughout the drawings to refer tothe same or like parts.

The present disclosure relates to traffic management, and moreparticularly to detecting and classifying content in secured orunsecured transactions. The detection and classification of contentinclude detecting boundaries of the secured or unsecured transactions;generating a multimedia session object based on the detected boundariesof the transactions; and classifying, based on the number oftransactions indicated by the multimedia session object, the content asbeing communicated under: HTTP live streaming (HLS) protocols, dynamicadaptive streaming over HTTP (DASH) protocols, and/or non-adaptivebit-rate protocols including progressive download protocols ornon-multimedia protocols. Such classification allows more customizedtraffic management or optimization. For example, with suchclassification, the traffic optimization can be customized forcommunication using iOS devices or Android devices, for adaptivebit-rate communications or progressive download communications, and forcommunications containing multimedia content or no multimedia content.

Network congestion or overload conditions in networks are oftenlocalized both in time and space and affect only a small set of users atany given time. This can be caused by the topology of communicationsystems. In an exemplary cellular communication system, such as thesystem shown in FIG. 1 , the system can have a tree-like topology, witha router or a gateway being the root of the tree and the mobile basestations being the leaves. This tree-like topology is similar acrosscellular technologies including Global System for Mobile Communication(GSM), Universal Mobile Telecommunications System (UMTS) adoptingWideband Code Division Multiple Access (W-CDMA) radio access technology,CDMA2000, Worldwide Interoperability for Microwave Access (WiMax) andLong Term Evolution (LTE). In a tree-like structure of a wirelessnetwork, the impact of network overload conditions depends on the levelof aggregation in the network where that overload condition occurs. Forexample, an overload condition at a base station level affects onlythose users who are connected to that base station. Therefore, in someembodiments, the adaptive traffic management identifies the aggregationlevel at which an overload condition occurs and then applies trafficmanagement techniques in a holistic fashion across only those users thatare affected by the overload condition.

Adaptive traffic management is an approach wherein traffic managementtechniques such as web and video optimization can be applied selectivelybased on monitoring key indicators that have an impact on the Quality ofExperience (QoE) of users or subscribers. Applying optimization caninvolve detecting the presence of multimedia content in secured orunsecured transactions and classifying multimedia content in thetransactions. Various embodiments of the present disclosure providedetecting the presence of multimedia content and classifying themultimedia content using, for example, pattern matching. In the presentdisclosure, a subscriber can be a mobile terminal user who subscribes toa wireless or cellular network service. While the subscriber refers tothe mobile terminal user here, future references to subscriber can alsorefer to a terminal that is used by the subscriber, or refer to a clientdevice used by the subscriber.

FIG. 1 is a block diagram of an exemplary network system. Exemplarycommunication system 100 can be any type of system that transmits datapackets over a network. For example, the exemplary communication system100 can include one or more networks transmitting data packets acrosswired or wireless networks to terminals (terminals not shown in FIG. 1). The exemplary communication system 100 can have network architecturesof, for example, a GSM network, a UMTS network that adopts Wideband CodeDivision Multiple Access (W-CDMA) radio access technology, a CDMA2000network, and a WiMax network.

The exemplary communication system 100 can include, among other things,one or more networks 101, 102, 103(A-D), one or more controllers104(A-D), one or more serving nodes 105(A-B), one or more base stations106(A-D)-109(A-D), a router 110, a gateway 120, and one or more adaptivetraffic managers 130(A-C). At a high level, the network topology of theexemplary communication system 100 can have a tree-like topology withgateway 120 being the tree's root node and base stations 106-109 beingthe leaves.

Router 110 is a device that is capable of forwarding data packetsbetween computer networks, creating an overlay Internetwork. Router 110can be connected to two or more data lines from different networks. Whena data packet comes in on one of the lines, router 110 can determine theultimate destination of the data packet and direct the packet to thenext network on its journey. In other words, router 110 can perform“traffic directing” functions. In the exemplary embodiment shown in FIG.1 , router 110 communicates with network 102 and gateway 120. Router 110directs traffic from the network 102 to the gateway 120 and vice versa.

Network 101 can be any combination of radio network, wide area networks(WANs), local area networks (LANs), or wireless networks suitable forpacket-type communications, such as Internet communications. Forexample, in one exemplary embodiment, network 101 can be a GeneralPacket Radio Service (GPRS) core network, which provides mobilitymanagement, session management and transport for Internet Protocolpacket services in GSM and W-CDMA networks. The exemplary network 101can include, among other things, a gateway 120, and one or more servingnodes 105(A-B).

Gateway 120 is a device that converts formatted data provided in onetype of network to a particular format required for another type ofnetwork. Gateway 120, for example, may be a server, a router, a firewallserver, a host, or a proxy server. Gateway 120 has the ability totransform the signals received from router 110 into a signal thatnetwork 101 can understand and vice versa. Gateway 120 may be capable ofprocessing webpage, image, audio, video, and T.120 transmissions aloneor in any combination, and is capable of full duplex media translations.As an exemplary embodiment, gateway 120 can be a Gateway GPRS SupportNode (GGSN) that supports interworking between the GPRS network andexternal packet switched networks, like the Internet and X.25 networks.

Serving nodes 105 are devices that deliver data packets from gateway 120to a corresponding network 103 within its geographical service area andvice versa. A serving node 105 can be a server, a router, a firewallserver, a host, or a proxy server. A serving node 105 can also havefunctions including packet routing and transfer, mobility management(attach/detach and location management), logical link management,network accessing mediation and authentication, and charging functions.As an exemplary embodiment, a serving node 105 can be a Serving GPRSSupport Node (SGSN). SGSN can have location register, which storeslocation information, e.g., current cell, current visitor location(Visitor Location Register) and user profiles, e.g., InternationalMobile Subscriber Identity (IMSI), and addresses used in the packet datanetwork, of all GPRS users registered with this SGSN.

Network 102 can include any combination of wide area networks (WANs),local area networks (LANs), or wireless networks suitable forpacket-type communications. In some exemplary embodiments, network 102can be, for example, Internet and X.25 networks. Network 102 cancommunicate data packet with network 101 with or without router 110.

Networks 103 can include any radio transceiver networks within a GSM orUMTS network or any other wireless networks suitable for packet-typecommunications. In some exemplary embodiments, depending on theunderlying transport technology being utilized, the Radio Access Network(RAN) or Backhaul area of network 103 can have a ring topology. In someembodiments, network 103 can be a RAN in a GSM system or a Backhaul areaof a UMTS system. The exemplary network 103 can include, among otherthings, base stations 106-109 (e.g., base transceiver stations (BTSs) orNode-Bs), and one or more controllers 104(A-C) (e.g., base-stationcontrollers (BSCs) or radio network controllers (RNCs)). Mobileterminals (not shown in FIG. 1 ) communicate with BTS/Node-B 106-109which have radio transceiver equipment. BTS/Node-B 106-109 communicatewith BSC/RNC 104(A-C), which are responsible for allocation of radiochannels and handoffs as users move from one cell to another. TheBSC/RNC 104(A-C) in turn communicate to serving nodes 105, which managemobility of users as well as provide other functions such as mediatingaccess to the network and charging.

As shown in FIG. 1 , adaptive traffic manager 130 can be deployed at oneor more locations within communication system 100, including variouslocations within network 101 and 103. In some embodiments, adaptivetraffic manager 130 can be located at gateway 120, at controller 104, atone or more base stations 106-109, or any other locations. Adaptivetraffic manager 130 can be either a standalone network element or can beintegrated into existing network elements such as gateway 120,controllers 104, and base stations 106-109. Adaptive traffic manager 130can continuously monitor several parameters of communication system 100.The parameters can be used to generate traffic management rules. Thetraffic management rules are generated dynamically and change inreal-time based on the monitored parameters. After the rules aregenerated in real time, the rules are applied to data traffic beinghandled by adaptive traffic manager 130. Moreover, adaptive trafficmanager 130 can include a multimedia detector and classifier 220 (shownin FIG. 2 ) for detecting the presence of multimedia contents in securedor unsecured transactions and for classifying the multimedia content insecured or unsecured transactions. Multimedia detector and classifier220 is described in more detail below.

To optimize web and video traffic, traffic management techniques can beimplemented on a proxy device (e.g., adaptive traffic manager 130) thatis located somewhere between a content server and client devices (e.g.,mobile terminals). The proxy device can determine the type of contentrequested by a mobile terminal (e.g., video content) and applyoptimization techniques. The content providers can transmit contentusing unsecured or secured communication protocols such as HypertextTransfer Protocol Secure (HTTPS), Transport Layer Security (TLS), andSecure Sockets Layer (SSL) protocols. The proxy device can determine thetype of content being transmitted in both unsecured and securedtransactions using client requests and server responses. In securedtransactions, the client requests and server responses are encrypted.Therefore the content of the client requests or server response may notbe decipherable by the proxy device.

Moreover, a variety of multimedia protocols above the HTTP layer areavailable for transmitting of multimedia contents. The protocols cangenerally be classified into two broad categories: progressive download(PD) protocols and adaptive bit-rate protocols. Examples of adaptivebit-rate protocols include HTTP live streaming (HLS), dynamic adaptivestreaming over HTTP (DASH), and smooth streaming. Examples ofprogressive download protocols include flash video (FLV) file and Mpeg-4(MP4) file downloads over HTTP.

For both progressive download and adaptive bit-rate protocols, the samemultimedia content at multiple quality levels (e.g., video resolutions1080p, 720p, etc.) can be stored at the server for transmitting toclient. In the case of transmitting of multimedia contents usingprogressive download protocols, the multimedia quality level requestedby the client cannot be changed after the initial selection at thebeginning of transmission. In the case of transmitting of multimediacontents using adaptive bit-rate protocols, the multimedia quality levelrequested by the client can be changed to reflect fluctuations in theavailable network bandwidth between the server and the client.Therefore, adaptive bit-rate protocols typically provide a better userexperience because the highest available quality level can be selectedbased on the available network bandwidth.

To apply traffic management techniques, such as to apply streamingpolicy control (SPC) to the transmission of multimedia contents, it isusually required to determine whether progressive download protocols oradaptive bit-rate protocols are used for the transmission. Moreover,multimedia session reporting can also require distinguishing betweenprogressive download protocols or adaptive bit-rate protocols. Streamingpolicy control can be any traffic management technique that manages dataflow or controls congestion associated with streaming of multimedia dataacross a network, such as the Internet. For example, SPC can allowstreaming of the multimedia data to more effectively share bandwidthswith other network traffics. SPC can also improves smoothness instreaming and provide decreased and more predictable latency.

FIG. 2 is a block diagram illustrating an embodiment of an exemplaryadaptive traffic manager 130. In some embodiments, as shown in FIG. 2 ,a multimedia detector and classifier 220 can be integrated with adaptivetraffic manager 130. In some embodiments, multimedia detector andclassifier 220 can be integrated into other existing network elementssuch as gateway 120, controllers 104, and/or one or more base stations106-109. Multimedia detector and classifier 220 can also be a standalonenetwork element located at gateway 120, controller 104, one or more basestations 106-109, or any other proper locations.

As shown in FIG. 2 , adaptive traffic manager 130 can include, amongother things, a traffic processing and policy enforcement unit 222 andmultimedia detector and classifier 220. Adaptive traffic manager 130 canhave one or more processors and at least one memory for storing programinstructions. The processor(s) can be a single or multiplemicroprocessors, field programmable gate arrays (FPGAs), or digitalsignal processors (DSPs) capable of executing particular sets ofinstructions. Computer-readable instructions can be stored on a tangibleand/or non-transitory computer-readable medium, such as random accessmemory (RAM), read-only memory (ROM), volatile memory, nonvolatilememory, hard drives, compact disc read-only memory (CD ROM), digitalversatile disc (DVD) memory, flash drives, magnetic strip storage,semiconductor storage, optical disc storage, magneto-optical discstorage, flash memory, registers, caches, and/or any other storagemedium. Singular terms, such as “memory” and “computer-readable storagemedium,” can additionally refer to multiple structures, such as aplurality of memories and/or computer-readable storage mediums.Alternatively, the methods can be implemented in hardware components orcombinations of hardware and software such as, for example, ASICs or oneor more computer.

Adaptive traffic manager 130 can obtain external data 201 forprocessing. External data 201 can include network probes, RemoteAuthentication Dial-In User Service (RADIUS), Policy Charging and RulesFunction (PCRF), and Subscriber Profile Repository (SPR). Adaptivetraffic manager 130 can also communicate with one or more terminals(e.g., client 210) and server 260, either directly or indirectly.

Traffic processing and policy enforcement (TPPE) unit 222 is a lowerstack in the processing stack of adaptive traffic manager 130. TPPE unit222 can receive content, which can include multimedia content such asvideo and/or web data, and provide the content to other elements and/ormodules in adaptive traffic manager 130. The content can be stored in adata storage device (e.g., data storage 236) that is local to or remotefrom adaptive traffic manager 130. TPPE unit 222 is responsible forrouting traffic between client 210 and one or more servers, e.g., server260 and server 262. TPPE unit 222 can also implement traffic managementtechniques including blocking, rate limiting, lossless and lossy datacompression, and other traffic optimization techniques. TPPE unit 222can be a software program and/or a hardware device.

Multimedia detector and classifier 220 can include, among other things,a multimedia detector 224, a transaction boundaries detector 226, atransaction identifier 228, a multimedia session generator 230, amultimedia classifier 232, and a transaction aligner 234. Each of thesecomponents can be one or more modules, which can be one or more packagedfunctional hardware units designed for use with other components or apart of a program that performs a particular function, corresponding tothe particular step, of related functions. Multimedia detector andclassifier 220 can also include a data storage 236, which can also beexternal to multimedia detector and classifier 220.

In some embodiments, multimedia detector 224 can detect the presence ofmultimedia content in transactions. Transaction boundaries detector 226can detect boundaries of the one or more transactions, as illustrated inFIGS. 4A-4C. Transaction identifier 228 can identify specifictransactions in the transactions based on the sizes of the specifictransactions. Multimedia session generator 230 can generate a multimediasession object based on the detected boundaries of the one or moretransactions, as illustrated in FIGS. 5A-5C. Multimedia classifier 232can classify, based on the number of transactions indicated by themultimedia session object, the content as being communicated under: HLSprotocols, DASH protocols, progressive download protocols, ornon-multimedia protocols, as illustrated in FIG. 6 . Transaction aligner234 can identify a mapping between transactions associated with a firstserver (e.g., server 260) and a second server (e.g., server 262), anddetermine an alignment score, as illustrated in FIG. 7 . The operationof multimedia detector and classifier 220 and its components are furtherdescribed using FIGS. 3-7 below.

FIG. 3 is a flowchart representing an exemplary method 300 for detectingand classifying content in one or more transactions, consistent withembodiments of the present disclosure. Referring to FIG. 3 , it will bereadily appreciated that the illustrated procedure can be altered todelete steps or further include additional steps. Method 300 can beperformed by adaptive traffic manager 130, and more particularly bymultimedia detector and classifier 220 of the adaptive traffic manager130. While method 300 is described as being performed by multimediadetector and classifier 220, it is appreciated that other components ofadaptive traffic manager 130 or other devices can be involved. Further,it is appreciated that any other adaptive traffic manager can alsoperform method 300.

Referring to FIG. 3 , multimedia detector and classifier 220, and moreparticularly multimedia detector 224 of multimedia detector andclassifier 220 can detect (step 320) the presence of multimedia contentin secured transactions, such as SSL/TLS transactions, or unsecuredtransactions. In some embodiments, multimedia detector 224 can acquireone or more handshake messages associated with a secured connection fortransmitting content between client 210 and server 260. A securedconnection can include a plurality of secured transactions fortransmitting content. For example, multimedia content (e.g., a videoclip or session) can be transmitted over several HTTP transactions andcan use one or more transmission control protocols (TCP) connections.After establishing the TCP connection, if the multimedia content arerequired to be encrypted, one or more secure tunnels between client 210and server 260 can be established using SSL or TLS protocols. Afterestablishing of the secure tunnels, all transactions between client 210and server 260 are encrypted and thus secured.

Referring back to FIG. 2 , to establish a secure tunnel, one or morehandshake messages, such as SSL/TLS handshake messages, can betransmitted between client 210 and server 260. In some embodiments,multimedia detector 224 can detect the presence of multimedia content insecured transactions based on the handshake messages. For example,multimedia detector 224 can determine the server name, thesource/destination name, or the host and domain name (e.g.,www.youtube.com) associated with the secured transactions. Multimediadetector 224 can detect the presence of the multimedia content in thesecured transactions based at least in part on the determined servername, source/destination name, or host and domain name. For example, ifthe domain name indicates that the identification of the host isyoutube.com, it is likely that multimedia content (e.g., a YouTubevideo) is present in the secured transactions.

In some embodiments, multimedia detector 224 can also detect thepresence of multimedia content in secured transactions based on themeta-data associated with a connection that corresponds to anestablished multimedia session. For example, after a secured connection(e.g., a SSL/TSL connection) is first established, adaptive trafficmanager 130 can store the meta-data associated with such connection(e.g., the host name or domain name) in a look-up table. Adaptivetraffic manager 130 can search the look-up table based on a sessionidentification (ID) that identifies a current session in the establishedconnection.

A current session can be a multimedia session that includes, forexample, one or more single video clip, one or more episodes, one ormore full-length movie, or any videos provided at a multimedia website(e.g., YouTube). In some embodiment, each session is associated with asession ID in the look-up table. A session can be interrupted or idlefor a period of time, and be resumed at a later time. As an example, amultimedia session can provide a first movie and a second movie. Thesession ID associated with the connection that provides the first moviecan be stored in a look-up table. The multimedia session can have anidle time interval between the first movie and a second movie. After themultimedia session resumes for the second movie, multimedia detector 224can retrieve the session ID of the current session from the meta-dataassociated with the current session. Based on the session ID, multimediadetector 224 can search the look-up table to determine whether thesession ID of the current session is associated with a connection of oneor more previously established multimedia sessions. If multimediadetector 224 determines that the session ID of the current session isassociated with such connection, multimedia detector 224 can determinethat it is likely that multimedia content (e.g., a YouTube video) ispresent in the current session.

In some embodiments, multimedia detector 224 can detect the presence ofmultimedia content based on one or more IP addresses associated with oneor more multimedia providing websites. For example, if multimediadetector 224 determines that the secured transactions are associatedwith a server/destination IP address of a known video providing website,it can determine that multimedia content (e.g., a YouTube video) islikely present in the secured transactions. The detection of thepresence of multimedia content is described in more detail in relatedU.S. patent application Ser. No. 14/503,274 filed on Sep. 30, 2014(Attorney Docket No. 09266.0095-00000).

As discussed above, a single TOP connection can carry one or moretransactions such as HTTP transactions. The one or more transactions caninclude one or more requests from client 210 and one or morecorresponding responses from server 260. Referring to FIG. 3 ,multimedia detector and classifier 220, and more particularlytransaction boundaries detector 226, can detect (step 330) theboundaries of one or more transactions between client 210 and server260. The operation of transaction boundaries detector 226 is describedin more detail using FIGS. 4A-40 .

FIG. 4A is a flowchart representing an exemplary method 400 fordetecting transaction boundaries, consistent with embodiments of thepresent disclosure. Referring to FIG. 4A, it will be readily appreciatedthat the illustrated procedure can be altered to delete steps or furtherinclude additional steps. Method 400 can be performed by adaptivetraffic manager 130, and more particularly by transaction boundariesdetector 226 of the adaptive traffic manager 130. While method 400 isdescribed as being performed by transaction boundaries detector 226, itis appreciated that other components of adaptive traffic manager 130 orother devices can be involved. Further, it is appreciated that any otheradaptive traffic manager can also perform method 400.

Referring to FIG. 4A, after an initial step 410, transaction boundariesdetector 226 can wait (step 411) for more data, e.g., request data orresponse data, from client 210 or server 260. After transactionboundaries detector 226 receives more data, it can determine (step 412)whether a connection is closed. As described above, adaptive trafficmanager 130 can receive data from client 210 and/or server 260. Contentcan be transmitted over a plurality of transactions using, for example,a TCP connection. If transaction boundaries detector 226 determines thata connection is closed, transaction boundaries detector 226 can close(step 414) any active request object and/or any active response object,and proceed to a stop 460. A request object is also referred to as aclient request object and a response object is also referred to as aserver response object. Request objects can store data representingclient requests and response objects can store data representing serverresponses.

Referring back to FIG. 2 , transaction boundaries detector 226 cangenerate request objects representing client requests provided by client210 and generate response objects representing server responses providedby server 260. FIG. 4B is a block diagram 470 illustrating an exemplaryplurality of client request objects 472A, 472B, . . . 472N (collectivelycalled client request objects 472) representing client requests. Togenerate client request objects 472, transaction boundaries detector 226can acquire request data included in the one or more client requests.Similarly, FIG. 4C is a block diagram 480 illustrating an exemplaryplurality of server response objects 482A, 482B, . . . 482N(collectively called server response objects 482) representing serverresponses. To generate server response objects 482, transactionboundaries detector 226 can acquire response data included in the one ormore server responses.

The request object and the response object can be any record, pointer,or data structure stored on a hardware and/or software-based datastorage device, for example, data storage 236. For example, the contentof the request objects and response objects can be stored as records orindexes in a single data structure or the content of each request objectand response object can be recorded in a separate transaction list datastructure.

Referring to FIGS. 4B-4C, transaction boundaries detector 226 can alsoassociate request data with corresponding request objects and associateresponse data with corresponding response objects. As described above, atransaction can include one or more requests from client 210 and one ormore corresponding responses from server 260. In some embodiments,server 260 (e.g., an HTTP content server) can wait for client 210 toprovide an entire request before it provides a response. The entirerequest can include one or more request data. Similarly, client 210 canwait for server 260 to provide an entire response before it provides asubsequent request. The entire response can include one or more responsedata. Transaction boundaries detector 226 can associate the one or morerequest data to the corresponding request object and associate the oneor more response data to the corresponding response object. Based on therequest objects and response objects, transaction boundaries detector226 can detect transaction boundaries, which is further described indetail below.

Referring to FIG. 4A, in step 412, if transaction boundaries detector226 determines that a connection (e.g., a TCP connection) is not closed,it can wait for data to be received from client 210 or server 260 andfurther determine (step 416) whether the idle time interval forreceiving data is greater than a preconfigured idle time threshold. Ifthe idle time interval for receiving data is greater than or equal tothe idle time threshold, transaction boundaries detector 226 can close(step 418) any active request object and/or any active response object.In some embodiments, an idle time interval that is greater than or equalto the idle time threshold can indicate that the content received afterthe elapse of the idle time is associated with another session. Forexample, if the idle time interval between two consecutive videos isgreater than a session idle time threshold (e.g., thirty seconds), thetwo consecutive videos can be represented in two multimedia sessions. Asa result, any active client request objects and server response objectsin the current session can be closed.

As shown in FIG. 4A, in step 416, if transaction boundaries detector 226determines that the idle time interval for receiving data is less than apreconfigured idle time threshold, it can acquire (step 420) the data,which can be request data included in the one or more client requestsfrom client 210 or response data included in the one or morecorresponding server responses from server 260. After acquiring thedata, transaction boundaries detector 226 can determine (step 422)whether the acquired data is request data or response data.

In step 422, if transaction boundaries detector 226 determines that theacquired data is request data, it further determines (step 424) whetheran active request object is open. As described above, a request objectcan be any record, pointer, or data structure stored on a hardwareand/or software-based data storage device, for example, data storage236. A request object can store request data provided by client 210. Insome embodiments, transaction boundaries detector 226 can generate anactive request object after it receives the first request data fromclient 210. If an active request object is open, transaction boundariesdetector 226 can associate additional request data to the active requestobject. If no active request object is open, transaction boundariesdetector 226 can generate an active request object to store the acquiredrequest data.

Referring to FIG. 4A, if transaction boundaries detector 226 determines(step 424) that an active request object is open, it can associate (step432) the acquired request data to the active request object. In someembodiments, transaction boundaries detector 226 can determine that noactive request object is open and generate (step 426) an active requestobject. As an example, transaction boundaries detector 226 can determinethat no active request object is open because the request data thattransaction boundaries detector 226 received is the first request dataprovided by client 210. As another example, transaction boundariesdetector 226 can determine that no active request object is open becausean active request object is closed before transaction boundariesdetector 226 received the request data. As shown in FIG. 4A, if noactive request object is open, transaction boundaries detector 226 cangenerate (step 426) an active request object.

Referring to FIG. 4A, in some embodiments, after generating an activerequest object, transaction boundaries detector 226 can determine (step430) whether an active response object is open. As described above, aresponse object can be any record, pointer, or data structure stored ona hardware and/or software-based data storage device, for example, datastorage 236. A response object can store response data provided by, forexample, server 260.

As shown in FIG. 4A, if transaction boundaries detector 226 determines(step 430) that no active response object is open, it can, associate(step 432) the acquired request data with the active request object. Asshown in FIG. 4A, if transaction boundaries detector 226 determines(step 430) that an active response object is open, it can close (step434) the active response object. The active request object and theactive response object can represent one or more client requests and oneor more server responses in a single transaction, respective. Thus, anysubsequent request data or response data can represent subsequent clientrequests or subsequent server responses, respectively, in subsequenttransactions. In some embodiments, transaction boundaries detector 226can close the current active response object for properly associate thesubsequent client request data with a subsequent transaction.

After closing the active response object, transaction boundariesdetector 226 can associate (step 432) the acquired request data to theactive request object. The active request object represents clientrequest in a subsequent transaction.

Referring back to step 422, transaction boundaries detector 226 candetermine whether the acquired data is request data or response data. Ifthe acquired data is not request data and is response data, transactionboundaries detector 226 can determine (step 440) whether an activeresponse object is open. If an active response object is open,transaction boundaries detector 226 can associate (step 442) theacquired response data with the active response object, where theacquired response data represent the server response to a prior clientrequest.

In some embodiments, after associating the acquired response data withthe active response object, transaction boundaries detector 226 canassociate (not shown) any additional response data to the activeresponse object if the additional response data are received beforesubsequent request data are received from client 210. In someembodiments, after associating the acquired response data with theactive response object, transaction boundaries detector 226 can closethe active response object if subsequent request data is received fromclient 210; if an idle time for receiving data is greater than or equalto an idle time threshold; or if the connection for transmitting contentbetween client 210 and server 260 is closed. A closed active responseobject and its corresponding request object can represent one or moreserver responses and one or more client requests in a singletransaction.

In step 440, if transaction boundaries detector 226 determines that noactive response object is open, transaction boundaries detector 226 canfurther determine (step 444) whether an active request object is open.If no active request object is open, it indicates that the acquiredresponse data do not represent a server response to a correspondingclient request, and thus are not part of a transaction. As a result,transaction boundaries detector 226 can discard (step 446) the acquiredresponse data.

In step 440, if transaction boundaries detector 226 determines that anactive response object is open, it indicates that the acquired responsedata represents a server response to a corresponding client request, andthus are part of a transaction including the client request. As aresult, transaction boundaries detector 226 can close (step 448) theactive request object, generate (step 450) an active response object,and associate (step 452) the acquired response data to the activeresponse object. The closed request object and the active responseobject represent client requests and server responses, respectively, ina single transaction.

As shown in FIG. 4A, after transaction boundaries detector 226 performssteps 432, 442, 446, or 452, it can repeat method 400 for processingmore data by, for example, go back to step 411. It is appreciated thattransaction boundaries detector 226 can repeat method 400 such that oneor more client requests are associated with one or more request objects,and one or more server responses are associated with response objects.

Based on the request objects and the response objects, transactionboundaries detector 226 can detect the transaction boundaries. Forexample, a transaction can include one or more client requestsrepresented by a request object and one or more server responsesrepresented by a response object corresponding to the request object.Thus, a transaction can be represented by a request object and acorresponding response object. In a transaction, one or more currentserver responses correspond to one or more prior client requests. As aresult, client requests that are subsequent to the one or more currentserver responses can indicate the beginning of a subsequent transaction.

Referring back to FIG. 3 , after transaction boundaries detector 226detects (step 330) boundaries of transactions, adaptive traffic manager130, and more particularly transaction identifier 228, can identify(step 340) one or more specific transactions based on the sizes of thespecific transactions. For example, transaction identifier 228 canestimate the size of a particular transaction, the size of a requestobject representing the client requests associated with the particulartransaction, and/or the size of a response object representing theserver responses associated with the particular transaction.

In some embodiments, transaction identifier 228 can determine whetherthe size of the response object in the particular transaction is lessthan a response object size threshold. The response object sizethreshold can be, for example, 4 Kbytes. If the size of the responseobject is less than the response object size threshold, transactionidentifier 228 can identify the particular transaction as a specifictransaction, such as a small transaction. In some embodiments, specifictransactions, such as small transactions are excluded when thetransactions are classified. More details of classifying thetransactions are described below.

Referring to FIG. 3 , adaptive traffic manager 130, and moreparticularly multimedia session generator 230, can generate (step 350) amultimedia session object based on the detected boundaries of the one ormore transactions. The multimedia session object can include one or morerequest objects and one or more corresponding response objects. In someembodiments, the multimedia session object can provide an indication ofthe number of transactions for communicating the content associated witha multimedia session between client 210 and server 260. An exemplaryoperation of multimedia session generator 230 is described in moredetail using FIGS. 5A-5C.

FIG. 5A is a flowchart representing an exemplary method 500 forgenerating a multimedia session object, consistent with embodiments ofthe present disclosure. Referring to FIG. 5A, it will be readilyappreciated that the illustrated procedure can be altered to deletesteps or further include additional steps. Method 500 can be performedby adaptive traffic manager 130, and more particularly by multimediasession generator 230 of the adaptive traffic manager 130. While method500 is described as being performed by multimedia session generator 230,it is appreciated that other components of adaptive traffic manager 130or other devices can be involved. Further, it is appreciated that anyother adaptive traffic manager can also perform method 500.

Referring to FIG. 5A, after an initial step 510, multimedia sessiongenerator 230 can identify (step 515), based on the detected boundariesof the one or more transactions, transactions that are associated withthe same client IP addresses and the same server IP address, or the samesource IP addresses and the same destination IP addresses. In someembodiments, transactions that are associated with the same client IPaddresses and the same server IP address can be included in a singlemultimedia session. Similarly, transactions that are associated with thesame source IP addresses and the same destination IP addresses can beincluded in a single multimedia session.

In some embodiments, after client 210 and server 260 has established asecured or unsecured connection for transmitting multimedia content,multimedia session generator 230 can generate (step 520) a multimediasession object, which can represent a multimedia session. A multimediasession object can be any record, pointer, or data structure stored on ahardware and/or software-based data storage device, for example, datastorage 236. For example, the contents of the multimedia session objectcan be stored as records or indexes in a single data structure or thecontents of each multimedia session object can be recorded in a separatetransaction list data structure.

In some embodiments, multimedia session generator 230 can associate oneor more request objects and one or more corresponding response objectswith a multimedia session object. FIG. 5B is a block diagramillustrating an exemplary multimedia session object 540 associated withmultiple request objects 542A-N, and multiple response objects 544A-N.For example, during a particular multimedia session, transactionboundaries detector 226 can generate a plurality of (e.g., five)requests objects and a plurality of (e.g., five) response objects. Ifmultimedia session generator 230 identifies that the client requestsrepresented by requests objects 542A-N are associated with the sameclient IP address and identifies that the server responses representedby response objects 544A-N are associated with the same server IPaddress, multimedia session generator 230 can associate the requestobjects and the corresponding response objects with a single multimediasession object 540. Therefore, multimedia session object 540 can providean indication of the number of transactions (e.g., five) forcommunicating the content associated with a multimedia session betweenclient 210 and server 260.

Referring back to FIG. 5A, after generating the multimedia sessionobject, multimedia session generator 230 can associate (step 525) themultimedia session object, which represents a corresponding multimediasession, with a look-up table. The look-up table can be searchable basedon a client/source IP address, a server/destination IP address, or aconcatenation of the client/source and server/destination IP addresses.FIG. 5C is an exemplary diagram illustrating an exemplary structure of amultimedia session object look-up table 550.

As shown in FIG. 5C, multimedia session generator 230 can establishmultimedia session object look-up table 550, e.g., a two level look-uptable. In look-up table 550, the first level can be searchable usingclient/source IP addresses and the second level can be searchable usingserver/destination IP addresses. For example, multimedia session objectlook-up table 550 can have a first level session table 560 that includesa plurality of client/source IP addresses. Each client/source IP addressidentifies a client (e.g., client 210) or the source of requests forcontent. For associating a multimedia session object to multimediasession object look-up table 550, multimedia session generator 230 cansearch first level session table 560 using the client/source IP addressof transactions represented by the multimedia session object.

Based on the search result, multimedia session generator 230 canidentify a second level session table. For example, as shown in FIG. 5C,if the multimedia session object includes client request objects thatrepresent client requests provided by client 1, multimedia sessiongenerator 230 can use the IP address of client 1 to search first levelsession table 560. Based on the search results, multimedia sessiongenerator 230 can identify second level session table 570.

Referring to FIG. 5C, multimedia session object look-up table 550 canhave one or more second level session tables 570, 580, and 590,corresponding to each client/source IP addresses. For example, secondlevel session tables 570, 580, and 590 corresponds to IP addressesassociated with client 1, client 2, and client N, respectively. As aresult, each second level session table includes a plurality ofserver/destination IP addresses identifying servers or destinations thatcommunicates with a different client (e.g., clients 1, 2, . . . N).

After searching first level session table 560, multimedia sessiongenerator 230 can further search a second level session table using aserver/response IP address of transactions represented by the multimediasession object. Based on the search result, multimedia session generator230 can associate the multimedia session object with a second levelsession table. For example, if the multimedia session object includesserver response objects that represent responses provided by server 1,multimedia session generator 230 can use the IP address of server 1 tosearch second level session table 570.

As described above, a multimedia session object represents a multimediasession that includes transactions between the same client/source andthe same server/destination. As a result, based on the search results ofsecond level session table 570, multimedia session generator 230 canassociate one or more multimedia session objects with look-up table 550using their server/destination IP addresses. For example, if multimediasession objects 572, 574, 576, and 578 represent multimedia sessionshaving transactions between client 1 and server 1, server 2, server 3,and server M, respectively, multimedia session generator 230 canassociate each of these multimedia session objects as a separate entrywith second level session table 570. Similarly, if multimedia sessionobjects 582, 584, 586, and 588 represent multimedia sessions havingtransactions between client 2 and server 1, server 2, server 3, andserver M, respectively, multimedia session generator 230 can associateeach of these multimedia session objects as a separate entry with secondlevel session table 580, and so forth.

Referring to FIG. 5A, multimedia session generator 230 can also retrieve(step 530) a multimedia session object from a look-up table beforeclassifying the content included in a corresponding multimedia session.For example, as shown in FIG. 50 , if the content of a multimediasession represented by multimedia session object 572 is to beclassified, multimedia session generator 230 can retrieve multimediasession object 572 based on its client/source IP address and itsserver/destination IP address. Using the client/source IP addressassociated with multimedia session object 572, multimedia sessiongenerator 230 can search first level session table 560 to identifysecond level session table 570. Using the server/destination IP addressassociated with multimedia session object 572, multimedia sessiongenerator 230 can search second level session table 570 to identifymultimedia session object 572. Based on the identification, multimediasession generator 230 can retrieve multimedia session object 572 forclassifying the content of the multimedia session represented bymultimedia session object 572. As shown in FIG. 5A, after retrieving themultimedia session object for classification, method 500 can proceed toa stop. It is appreciated that method 500 can also be repeated forgenerating additional multimedia session objects, associating theadditional multimedia session objects with look-up table 550, andretrieving the additional multimedia session objects for classification.

Referring back to FIG. 3 , after multimedia session generator 230generates the multimedia session objects, adaptive traffic manager 130,and more particularly multimedia classifier 232, can classify (step 360)the content associated with multimedia sessions represented by themultimedia session objects. An exemplary operation of multimediaclassifier is described in more detail using FIG. 6 .

FIG. 6 is a flowchart representing an exemplary method 600 forclassifying content associated with a multimedia session represented bya multimedia session object, consistent with embodiments of the presentdisclosure, Referring to FIG. 6 , it will be readily appreciated thatthe illustrated procedure can be altered to delete steps or furtherinclude additional steps. Method 600 can be performed by adaptivetraffic manager 130, and more particularly by multimedia classifier 232of the adaptive traffic manager 130. While method 600 is described asbeing performed by multimedia classifier 232, it is appreciated thatother components of adaptive traffic manager 130 or other devices can beinvolved. Further, it is appreciated that any other adaptive trafficmanager can also perform method 600.

As shown in FIG. 2 , in some embodiments, multimedia classifier 232 canclassify the content in secured or unsecured transactions as beingcommunicated under: HLS protocols, DASH protocols, progressive downloadprotocols, or non-multimedia protocols. HLS protocols and DASH protocolsare examples of adaptive bit-rate protocols. Adaptive bit-rate protocolsdiffer from the progressive download protocols in several aspects,including, for example, the behavior at the beginning of thetransmission of the content. In some embodiments, under the adaptivebit-rate protocols, during the beginning of the transmission (e.g., afew seconds), client 210 can estimate the channel bandwidth anddynamically change the quality level of the content. As an example, ifthe current quality level is low (e.g., 240p) and client 210 determinesthat the available bandwidth is enough to increase the quality level byone or more resolution steps, client 210 can request to increase qualitylevel (e.g., to 720p) in subsequent messages it sends to server 260. Asanother example, if client 210 determines that the current availablebandwidth is not enough to support the current quality level (e.g.,1080p) associated with the multimedia content, client 210 can request todecrease the quality level (e.g., to 720p) in subsequent messages itsends to server 260.

As discussed above, under the adaptive bit-rate protocols, client 210can request to change (increase or decrease) the multimedia qualitylevels. In some embodiments, at least partially due to such changes, thenumber of transactions during the beginning period of transmitting themultimedia content under the adaptive bit-rate protocols can be greaterthan the number of transactions under the progressive downloadprotocols. As stated above, under the progressive download protocols,client 210 does not request to change the quality level; accordingly,the multimedia content is transmitted from server 260 using a singlequality level. As such, the number of transactions in the transmissionunder the progressive download protocols can be smaller (e.g., onetransaction) than the number of transactions in the transmission underthe adaptive bit-rate protocols. Moreover, sizes of the transactions incommunications under the HLS protocols, DASH protocols, progressivedownload protocols, or non-multimedia protocols can be different. As aresult, multimedia classifier 232 can classify the content in secured orunsecured transactions based on the number of transactions and/or basedon the sizes of transactions.

Referring to FIG. 6 , after an initial step 610, multimedia classifier232 can wait for transactions and/or obtain (step 612) a multimediasession object, which represents a multimedia session. For example,multimedia classifier 232 can wait for one or more client requestobjects representing client requests and/or one or more server responseobjects representing server responses to be associated with themultimedia session object. As described above, client request objectsand server response objects can be associated to one or more multimediasession objects based on their client/source IP addresses andserver/destination IP addresses. After such association, the multimediasession objects can be inserted into a look-up table. Multimediaclassifier 232 can obtain a multimedia session object by, for example,retrieving the multimedia session object from a look-up table.

After multimedia classifier 232 obtains the multimedia session object,it can determine (step 614) the relation of the number of transactionsassociated with the multimedia session object with respect to a firstthreshold number of transactions. As described above, a multimediasession object (e.g., multimedia session object 540) represents amultimedia session having one or more transactions. Each transaction caninclude, for example, one client request and one corresponding serverresponse. A multimedia session object can thus include one or moreclient request objects (e.g., client request objects 542) representingclient requests and one or more corresponding server responses objects(e.g., server response objects 544) representing server responses. As aresult, a multimedia session object can provide the indication of thenumber of transactions using the number of client request objects andthe number of server response objects. For example, if a multimediasession object includes five client request objects and five serverresponse objects, the number of transactions is five for the multimediasession represented by the multimedia session object.

The first threshold number of transactions can be, for example, four orsix. As described above, the number of transactions in communicationsunder the adaptive bit-rate protocols, such as the HLS or DASH protocolscan be greater than the number of transactions in communications underthe progressive download protocols or non-multimedia protocols.Therefore, if the number of transactions associated with the multimediasession object is greater than or equal to a first threshold number oftransactions (e.g., four transactions or six transactions), thetransactions are likely communicated under the adaptive bit-rateprotocols. As a result, multimedia classifier 232 can further determine,in the subsequent steps, whether the transactions are communicated underthe HLS protocols or the DASH protocols.

In some embodiments, if the number of transactions associated with themultimedia session object is less than the first threshold number oftransactions (e.g., four transactions), multimedia classifier 232 canwait for a period of time to allow more client request objects and/ormore server response objects to be associated with the multimediasession object. Multimedia classifier 232 can obtain the updatedmultimedia session object and determine again the relation of the numberof transactions associated with the multimedia session object withrespect to the first threshold number of transactions.

Referring to FIG. 6 , if the number of transactions associated with themultimedia session object is greater than or equal to the firstthreshold number of transactions, multimedia classifier 232 can obtain(step 616) the number of transactions that have sizes corresponding toan HLS audio transaction size range. In some embodiments, a transactioncan be a video transaction or an audio transaction. A server response ina video transaction can include video data and a server response in anaudio transaction can include audio data. The server response can berepresented by a server response object.

For a particular multimedia session, multimedia classifier 232 canobtain the sizes of the transaction using the server response objectsand/or client request objects included in the multimedia session objectthat represents the multimedia session. The size of a response caninclude, for example, the size of the video or audio content provided byserver 260. Additionally, the size of a response can also include thesize of headers (e.g., HTTP headers) and the size of other overheads dueto, for example, SSL/TLS encryptions. In some embodiments, the size ofthe response can be much greater than the sizes of the headers and otheroverheads. To account for the headers and overheads, a size range can beused to indicate the size of a transaction. Moreover, the size of atransaction can include the size of a server response and a size of aclient request. In some embodiments, the transaction size ispredominated by the response size. As such, the size range can also beused to indicate the size of a transaction by taking into account thesize of a client request.

The ranges of audio transaction sizes or video transaction sizes can bedifferent for different quality levels (e.g., bitrates) and fordifferent types of protocols. For example, for transactions communicatedunder the HLS protocols, the size ranges of audio transactions can haveranges of 28,597-33,899 bytes, 58,697-67,271 bytes, and 78,097-89,515bytes, corresponding to audio bitrates of 48 Kbps, 96 Kbps, and 128Kbps.

In some embodiments, the number of different size ranges of video oraudio transactions can be limited. For example, for transactionscommunicated under the HLS protocols by YouTube™, the media time lengthin a single video or audio transaction can be fixed (e.g., 5 seconds).As a result, the number of different size ranges of transactionscommunicated under the HLS protocols by YouTube′ can also be limited. Asan example, the audio transactions communicated under the HLS protocolsby YouTube™ have a limited number of size ranges, e.g., 28,597-33,899bytes, 58,697-67,271 bytes, and 78,097-89,515 bytes corresponding to thethree audio bitrates of 48 Kbps, 96 Kbps, and 128 Kbps.

Multimedia classifier 232 can obtain the number of transactions thathave sizes corresponding to the size ranges of HLS audio transactions.For example, using a multimedia session object, multimedia classifier232 can obtain the size of each transaction associated with themultimedia session object. Multimedia classifier 232 can compare thesize of each transaction with each of the size ranges of HLS audiotransactions to determine whether the size of each transaction fallswithin a size range of HLS audio transactions. Based on thedetermination, multimedia classifier 232 can obtain the number oftransactions having transaction sizes that fall within the size rangesof HLS audio transactions.

Referring to FIG. 6 , multimedia classifier 232 can determine (step 620)the relation of the number of a first type transactions (e.g., HLS audiotransactions) with respect to a second threshold number of transactions.In some embodiments, if the number of the first type transactionssatisfies the second threshold number of transactions, multimediaclassifier 232 can classify (step 622) the content associated with themultimedia session represented by the multimedia session object as beingcommunicated under the HLS protocols. For example, the second thresholdnumber of transactions can be two or three. Thus, if the number of HLSaudio transactions is greater than or equal to two or three, multimediaclassifier 232 classifies the content associated with the correspondingmultimedia session as being communicated under the HLS protocols.

In some embodiments, after multimedia classifier 232 classifies thecontent as being communicated under the HLS protocols, multimediaclassifier 232 can proceed to steps 650, 652, 670, and/or 672 to furtherdetermine, based on the identity of client 210, whether the contentassociated with the corresponding multimedia session is beingcommunicated under the HLS protocols or the DASH protocols. Such furtherdetermination can be required because the transaction size ranges ofcertain transactions overlap between the HLS protocols and the DASHprotocols. For example, one transaction size of an audio HLS transactionis 58,697-67,271 bytes corresponding to the 96 Kpbs bitrate with a5-second media time length; and one response size of an audio DASHtransaction is 65,512-66,540 bytes corresponding to the 128 Kpbs bitratewith a 5.5-second media time length. Therefore, these two size rangesoverlap and further determination can be required. Steps 650, 652, 670,and 672 are described in more detail below.

Referring to FIG. 6 , if the number of the first type transactions doesnot satisfy the second threshold number of transactions, multimediaclassifier 232 can obtain (step 624) the number of audio transactionshaving transactions sizes corresponding to a DASH audio transaction sizerange. As discussed above, the number of different size ranges of videoor audio transactions can be limited. For example, for transactionscommunicated under the DASH protocols by YouTube™, the media time lengthin a single video or audio transaction can be fixed (e.g., 5.5 seconds,10 seconds, or 20 seconds). As a result, the number of different sizeranges of transactions communicated under the DASH protocols by YouTube′can also be limited. As an example, the audio transactions communicatedunder the DASH protocols by YouTube™ have a limited number of sizeranges as illustrated in Table 1 below.

TABLE 1 YouTube ™ DASH audio transaction sizes. Audio Bitrate/ ResponseSize Response Size Media Time Length Low (bytes) High (bytes) 128kbps/10 seconds 155,339 162,412 96 kbps/10 seconds 114,389 123,369 128kbps/4 seconds Or 65,512 66,540 96 kbps/5.5 seconds 96 kbps/20 seconds237,426 246,642 128 kbps/20 seconds 313,745 328,127

In some embodiments, multimedia classifier 232 can obtain the number oftransactions that have transaction sizes corresponding to the sizeranges of DASH audio transactions. For example, using a multimediasession object, multimedia classifier 232 can obtain the transactionsize of each transaction associated with the multimedia session object.Multimedia classifier 232 can compare the transaction size of eachtransaction with each of the size ranges of DASH audio transactions todetermine whether the transaction size of each transaction falls withina size range of DASH audio transactions (e.g., one of the size rangesshown in Table 1 above). Based on the determination, multimediaclassifier 232 can obtain the number of transactions having transactionsizes that fall within the size ranges of DASH audio transactions.

Referring to FIG. 6 , multimedia classifier 232 can determine (step 630)the relation of the number of a second type transactions (e.g., DASHaudio transactions) with respect to a third threshold number oftransactions. In some embodiments, if the number of the second typetransactions satisfies the third threshold number of transactions,multimedia classifier 232 can classify (step 632) the content associatedwith the corresponding multimedia session represented by the multimediasession object as being communicated under the DASH protocols. Forexample, the third threshold number of transactions can be one or two.Thus, if the number of DASH audio transactions is greater than or equalto one or two, multimedia classifier 232 classifies the contentassociated with the corresponding multimedia session as beingcommunicated under the DASH protocols.

In some embodiments, after multimedia classifier 232 classifies contentas being communicated under the DASH protocols, multimedia classifier232 can proceed to steps 650, 652, 670, and/or 672 to further determine,based on the identity of client 210, whether the content associated withthe corresponding multimedia session is being communicated under the HLSprotocols or the DASH protocols. As discussed above, furtherdetermination can be required because the transaction size ranges incertain transactions overlap between HLS protocols and DASH protocols.For example, one transaction size of an audio HLS transaction is58,697-67,271 bytes corresponding to the 96 Kpbs bitrate with a 5-secondmedia time length; and one transaction size of an audio DASH transactionis 65,512-66,540 bytes corresponding to the 128 Kpbs bitrate with a5.5-second media time length. Therefore, these two size ranges overlapand further determination can be required.

Referring to FIG. 6 , in step 650, multimedia classifier 232 candetermine whether the identity of client 210 is a first device type(e.g., Apple® iOS devices such as iPad, iPhone, MacBook, etc.). If theidentity of client 210 is the first device type, multimedia classifier232 can classify (step 652) the content associated with thecorresponding multimedia session as being communicated under the HLSprotocols. If the identity of client 210 is not the first device type,multimedia classifier 232 can determine (step 670) whether the identityof client 210 is a second device type (e.g., Android® devices such asNexus™ phones and tablets). If the identity of client 210 is the seconddevice type, multimedia classifier 232 can classify (step 672) thecontent associated with the corresponding multimedia session as beingcommunicated under the DASH protocols. If the identity of client 210 isnot the second device type, method 600 can proceed to a stop 680.

Referring back to step 630 of FIG. 6 , in some embodiments, if thenumber of the second type transactions (e.g., DASH audio transactions)does not satisfies the third threshold number of transactions (e.g., oneor two transactions), multimedia classifier 232 can determine (step 640)whether the host or domain that provides the content associated with thetransactions provide multimedia content exclusively. If the host ordomain provides multimedia content exclusively, multimedia classifier232 classifies (step 644) content associated with the correspondingmultimedia session as being communicated under progressive downloadprotocols. If the host or domain does not provide multimedia contentexclusively, multimedia classifier 232 can determine (step 660) therelation of an average transaction size of the transactions associatedwith the multimedia session object with respect to a threshold size.

In some embodiments, for transactions communicating multimedia content,the average transaction size is typically greater than that oftransactions communicating only non-multimedia content. Therefore, ifthe average transaction size of the transactions associated with themultimedia session object is greater than or equal to a threshold size(e.g., 1 MB or 2 MB), multimedia classifier 232 can classify (step 644)the content associated with the corresponding multimedia sessionrepresented by the multimedia session object as being communicated underprogressive download protocols. If the average transaction size of thetransactions associated with the multimedia session object is less thana threshold size (e.g., 1 MB or 2 MB), multimedia classifier canclassify (step 662) the content associated with the correspondingmultimedia session object as being communicated under non-multimediaprotocols.

After steps 644, 662, 670, or 672 for classifying the content associatedwith the corresponding multimedia session represented by the multimediamedia session object as being communicated under one of: HLS, DASH,progressive download, or non-multimedia protocols, method 600 canproceed to a stop 680. It is appreciated that method 600 can be repeatedto classify more content.

FIG. 7 is a flowchart representing an exemplary method 700 forclassifying content in a plurality of transactions associated with twoor more of servers, consistent with embodiments of the presentdisclosure. Referring to FIG. 7 , it will be readily appreciated thatthe illustrated procedure can be altered to delete steps or furtherinclude additional steps. Method 700 can be performed by adaptivetraffic manager 130, and more particularly by multimedia detector 224,transaction boundaries detector 226, transaction identifier 228,multimedia session generator 230, multimedia classifier 232, andtransaction aligner 234 of the adaptive traffic manager 130. Whilemethod 700 is described as being performed by these components ofadaptive traffic manager 130, it is appreciated that other components ofadaptive traffic manager 130 or other devices can be involved. Further,it is appreciated that any other adaptive traffic manager can alsoperform method 700.

As discussed above using FIGS. 2-6 , adaptive traffic manager 130 canclassify content associated with a first multimedia session as beingcommunicated under HLS or DASH protocols. In some embodiments, based onsuch classification, adaptive traffic manager 130 can further classifycontent associated with a second multimedia session as beingcommunicated under HLS or DASH protocols, where the second multimediasession is communicated between the same client (e.g., client 210) asthe first multimedia session, and the same or different server (e.g.,server 262). For example, referring to FIG. 2 , a first multimediasession can be communicated between client 210 and server 260; and asecond multimedia session can be communicated between client 210 andserver 262. Adaptive traffic manager 130 can classify content associatedwith the second multimedia session using the classification of contentassociated with the first multimedia session.

Referring to FIG. 7 , after an initial step 710, transaction boundariesdetector 226 can detect (step 720) boundaries of one or moretransactions associated with a second server (e.g., server 262). The oneor more transactions associated with the second server can include oneor more client requests from client 210 and one or more correspondingserver responses from server 262. Multimedia session generator 230 cangenerate (step 730) a second multimedia session object based on thedetected boundaries of the one or more transactions between client 210and server 262. The multimedia session object can provide an indicationof a number of transactions for communicating content associated withthe second multimedia session between client 210 and the server 262. Thedetails for detecting transaction boundaries and for generating thesecond multimedia session object can be substantially similar to thosedescribed above, and thus are not repeatedly described.

Referring to FIG. 7 , after generating the second multimedia sessionobject representing the second multimedia session, transaction aligner234 can identify (step 740) a mapping between the one or moretransactions associated with the first server (e.g., server 260) and theone or more transactions associated with the second server (e.g., server262). For example, transaction aligner 234 can identify the mappingusing a dynamic time warping (DTW) algorithm based on timestamps of theone or more transactions associated with server 260 and the one or moretransactions associated with server 262. Using the DTW algorithm,transaction aligner 234 can determine a score matrix. One or more scoresin the score matrix can represent the optimal or least score formatching a transaction associated with server 260 and a transactionassociated with server 262.

In some embodiments, transaction aligner 234 can determine (step 750)one or more alignment scores based on the mapping. The one or morealignment scores can form an optimal matching path between alltransactions associated with server 260 and all transactions associatedwith server 262. The alignment scores can be time alignment scoresbetween the first multimedia session represented by the first multimediasession object and the second multimedia session represented by thesecond multimedia session object. The time alignment scores can beoptimal scores or least scores (e.g., smallest scores) for matching eachtransaction associated with server 260 and each transactions associatedwith server 262. For example, if a score is the smallest in its rowand/or column of the score matrix, it can be the optimal score or theleast score. If mapping of a transaction associated with server 260 anda transaction associated with server 262 results in an optimal orsmallest score, it can indicate that the two transactions are close intime. The identification of a mapping and the determination of alignmentscores are similar to those described in more detail in related U.S.patent application Ser. No. 14/622,139, filed with the currentapplication, (Attorney Docket No. 09266.0107-00000).

Referring to FIG. 7 , multimedia classifier 232 can classify (step 760),based on the alignment score, the content associated with the secondmultimedia session as being communicated under HLS protocols or DASHprotocols corresponding to the classification of content associated withthe first multimedia session. For example, if the multimedia classifier232 classifies the first multimedia session (e.g., the session betweenclient 210 and server 260) as being communicated under the HLS protocolsor DASH protocols, and if the alignment score is less than or equal toan alignment score threshold, multimedia classifier 232 can classify thesecond multimedia session (e.g., the session between client 210 andserver 262) as also being communicated under the HLS protocols or DASHprotocols, respectively.

After classifying the multimedia content associated with the secondmultimedia session, method 700 can proceed to a stop 770. It isappreciated that method 700 can also be repeated to classify morecontent associated with other multimedia sessions communicated withother servers.

In the foregoing specification, an element (e.g., adaptive trafficmanager or multimedia classifier) can have one or more processors and atleast one memory for storing program instructions corresponding tomethods 300, 400, 500, 600, and 700, consistent with embodiments of thepresent disclosure. The processor(s) can be a single or multiplemicroprocessors, field programmable gate arrays (FPGAs), or digitalsignal processors (DSPs) capable of executing particular sets ofinstructions. Computer-readable instructions can be stored on a tangiblenon-transitory computer-readable medium, such as random access memory(RAM), read-only memory (ROM), volatile memory, nonvolatile memory, harddrives, compact disc read-only memory (CD ROM), digital versatile disc(DVD) memory, flash drives, magnetic strip storage, semiconductorstorage, optical disc storage, magneto-optical disc storage, flashmemory, registers, caches, and/or any other storage medium.Alternatively, the methods can be implemented in hardware components orcombinations of hardware and software such as, for example, ASICs and/orspecial purpose computers.

Embodiments have been described with reference to numerous specificdetails that can vary from implementation to implementation. Certainadaptations and modifications of the described embodiments can be made.Other embodiments can be apparent to those skilled in the art fromconsideration of the specification and practice of the embodimentsdisclosed herein. It is intended that the specification and examples beconsidered as exemplary only. It is also intended that the sequence ofsteps shown in figures are only for illustrative purposes and are notintended to be limited to any particular sequence of steps. As such,those skilled in the art can appreciate that these steps can beperformed in a different order while implementing the same method.

1. An apparatus for classifying content in one or more transactions,comprising: a transaction boundary detector configured to detectboundaries of the one or more transactions associated with a firstserver or a first destination, wherein the one or more transactionsinclude one or more requests from a client or a source and one or morecorresponding responses from the first server or the first destination;a multimedia session generator configured to generate a multimediasession object based on the detected boundaries of the one or moretransactions; a multimedia classifier configured to classify the contentassociated with a first multimedia session; and a traffic processing andpolicy enforcement unit configured to apply traffic management to thefirst multimedia session based upon the classification.
 2. The apparatusof claim 1, wherein the applied traffic management includes at least oneof blocking, rate limiting, and lossless and lossy data compression. 3.The apparatus of claim 1, further comprising a multimedia detectorconfigured to detect the presence of multimedia content in the one ormore transactions, prior to the detection of the boundaries by thetransaction boundary detector.
 4. The apparatus of claim 1, wherein thetransaction boundary detector is configured to detect boundaries basedon at least one of a closed TCP connection or an idle time betweenconsecutive transactions.
 5. The apparatus of claim 1, wherein detectingthe boundaries comprises: acquire data that is request data or responsedata, the request data being included in the one or more requests fromthe client or the source and the response data being included in the oneor more corresponding responses from the first server or the firstdestination; determine whether the acquired data is request data orresponse data; if the acquired data is request data, determine whetheran active request object is open; and if the acquired data is responsedata, determine whether an active response object is open.
 6. Theapparatus of claim 1, further comprising a transaction identifierconfigured to, prior to the multimedia session generator generates themultimedia session object: identify specific transactions in the one ormore transactions based on the sizes of the specific transactions. 7.The apparatus of claim 1, wherein the multimedia session generator isconfigured to generate the multimedia session object comprises themultimedia session generator being configured to: identify, based on thedetected boundaries of the one or more transactions, transactions thatare associated with the same client IP addresses and the same server IPaddress, or the same source IP addresses and the same destination IPaddresses; and generate the multimedia session object based on theidentification.
 8. The apparatus of claim 1, wherein the multimediaclassifier is configured to classify the content comprises themultimedia classifier being configured to: determine the relation of thenumber of transactions associated with the multimedia session objectwith respect to a first threshold number of transactions; and if thenumber of transactions associated with the multimedia session objectsatisfies the first threshold number of transactions, determine therelation of the number of a first type transactions with respect to asecond threshold number of transactions, the first type of transactionshaving transaction sizes corresponding to an audio transaction sizerange of the HLS protocols.
 9. A method for classifying content in oneor more transactions, comprising: detecting boundaries of the one ormore transactions associated with a first server or a first destination,wherein the one or more transactions include one or more requests from aclient or a source and one or more corresponding responses from thefirst server or the first destination; generating a multimedia sessionobject based on the detected boundaries of the one or more transactions;classifying content associated with a first multimedia session; andapplying traffic management to the first multimedia session based uponthe classification.
 10. The method of claim 9, wherein applying thetraffic management comprises at least one of blocking, rate limiting,and lossless and lossy data compression.
 11. The method of claim 9,further comprising a detecting the presence of multimedia content in theone or more transactions, prior to the detection of the boundaries. 12.The method of claim 9, wherein detecting the boundaries is based on atleast one of a closed TCP connection or an idle time between consecutivetransactions.
 13. The method of claim 9, wherein detecting theboundaries comprises: acquiring data that is request data or responsedata, the request data being included in the one or more requests fromthe client or the source and the response data being included in the oneor more corresponding responses from the first server or the firstdestination; determining whether the acquired data is request data orresponse data; if the acquired data is request data, determining whetheran active request object is open; and if the acquired data is responsedata, determining whether an active response object is open.
 14. Themethod of claim 9, further comprising, prior to generating themultimedia session object, identifying specific transactions in the oneor more transactions based on the sizes of the specific transactions.15. The method of claim 9, wherein generating the multimedia sessionobject comprises: identifying, based on the detected boundaries of theone or more transactions, transactions that are associated with the sameclient IP addresses and the same server IP address, or the same sourceIP addresses and the same destination IP addresses; and generating themultimedia session object based on the identification.
 16. The method ofclaim 9, wherein classifying the content comprises: determining therelation of the number of transactions associated with the multimediasession object with respect to a first threshold number of transactions;and if the number of transactions associated with the multimedia sessionobject satisfies the first threshold number of transactions, determinethe relation of the number of a first type transactions with respect toa second threshold number of transactions, the first type oftransactions having transaction sizes corresponding to an audiotransaction size range of the HLS protocols.
 17. A non-transitorycomputer readable storage medium storing instruction that are executableby one or more processors of an apparatus to cause the apparatus toperform a method for classifying content in one or more transactions,the method comprising: detecting boundaries of the one or moretransactions associated with a first server or a first destination,wherein the one or more transactions include one or more requests from aclient or a source and one or more corresponding responses from thefirst server or the first destination; generating a multimedia sessionobject based on the detected boundaries of the one or more transactions;classifying content associated with a first multimedia session; andapplying traffic management to the first multimedia session based uponthe classification.
 18. The computer readable storage medium of claim17, wherein applying the traffic management comprises at least one ofblocking, rate limiting, and lossless and lossy data compression. 19.The computer readable storage medium of claim 17, wherein detecting theboundaries comprises: acquiring data that is request data or responsedata, the request data being included in the one or more requests fromthe client or the source and the response data being included in the oneor more corresponding responses from the first server or the firstdestination; determining whether the acquired data is request data orresponse data; if the acquired data is request data, determining whetheran active request object is open; and if the acquired data is responsedata, determining whether an active response object is open.
 20. Thecomputer readable storage medium of claim 17, wherein classifying thecontent comprises: determining the relation of the number oftransactions associated with the multimedia session object with respectto a first threshold number of transactions; and if the number oftransactions associated with the multimedia session object satisfies thefirst threshold number of transactions, determine the relation of thenumber of a first type transactions with respect to a second thresholdnumber of transactions, the first type of transactions havingtransaction sizes corresponding to an audio transaction size range ofthe HLS protocols.